ShinyHunters claims FBI breach as Clop leak site is hijacked

September 2026 brought breaches and attacks affecting government, identity-verification, financial, healthcare and technology organisations, according to SOCRadar. ShinyHunters claimed it stole 2 to 3 TB of data from FBI systems through an alleged Oracle PeopleSoft zero-day and shared about 5,000 purported staff records with reporters, who verified parts of the set. The FBI later said a contractor had failed to apply an available patch; Oracle had not confirmed a new PeopleSoft zero-day by 27 October.

The same group hijacked the Clop ransomware gang’s leak site through a Grav flaw, CVE-2026-42608. Clop said the affected server held website content only. IDScan[.]net confirmed unauthorised access to its VeriScan platform between 4 April and 2 September; potentially exposed information included names, contact details, dates of birth and government ID numbers. The FBI opened an investigation after a Dark Web service advertised more than 153 million driver’s licence scans.

Several incidents involved exploited vulnerabilities or compromised third parties. Researchers said AI agents used already-disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, to compromise at least 440 instances across 395 organisations in 48 countries. A separate Chrome and Windows zero-day chain reached at least four espionage clusters; Google and Microsoft issued fixes, and CISA added the flaws to its Known Exploited Vulnerabilities catalogue.

Bitget raised its loss from an attack on hot and warm wallets to $387.5 million, while saying cold wallets were unaffected; no government had attributed the attack by 27 October. Other disclosures included a CenterPoint Energy breach affecting 1,062,060 Texans, a Gyazo breach exposing about 23.62 million user records, and Revolut’s disclosure that it had answered a fraudulent government data request. Veradigm said data was taken through a third-party vendor, but had not given a patient count.